From f7ec01c9387a1f8bdbcb360887342f9496dd4e8e Mon Sep 17 00:00:00 2001
From: Lubrsy706 <lubrsy706@gmail.com>
Date: Tue, 19 May 2026 16:14:36 +0800
Subject: [PATCH] fix(cli): include auth on demo REST calls

Signed-off-by: Lubrsy706 <lubrsy706@gmail.com>
---
 src/cli.ts                 | 15 ++++++++-------
 src/cli/http-auth.ts       | 15 +++++++++++++++
 test/cli-http-auth.test.ts | 26 ++++++++++++++++++++++++++
 3 files changed, 49 insertions(+), 7 deletions(-)
 create mode 100644 src/cli/http-auth.ts
 create mode 100644 test/cli-http-auth.test.ts

diff --git a/src/cli.ts b/src/cli.ts
index 5eca18ce..ee1419d5 100644
--- a/src/cli.ts
+++ b/src/cli.ts
@@ -43,6 +43,10 @@ import { isFirstRun, readPrefs, resetPrefs, writePrefs } from "./cli/preferences
 import { runOnboarding } from "./cli/onboarding.js";
 import { setBootVerbose } from "./logger.js";
 import { VERSION } from "./version.js";
+import {
+  agentmemoryAuthHeaders,
+  agentmemoryJsonHeaders,
+} from "./cli/http-auth.js";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const args = process.argv.slice(2);
@@ -1067,12 +1071,9 @@ async function main() {
 
 async function apiFetch<T = unknown>(base: string, path: string, timeoutMs = 5000): Promise<T | null> {
   try {
-    const headers: Record<string, string> = {};
-    const secret = process.env["AGENTMEMORY_SECRET"];
-    if (secret) headers["Authorization"] = `Bearer ${secret}`;
     const res = await fetch(`${base}/agentmemory/${path}`, {
       signal: AbortSignal.timeout(timeoutMs),
-      headers,
+      headers: agentmemoryAuthHeaders(),
     });
     return (await res.json()) as T;
   } catch {
@@ -1691,7 +1692,7 @@ async function postJson<T = unknown>(
   try {
     const res = await fetch(url, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
+      headers: agentmemoryJsonHeaders(),
       body: JSON.stringify(body),
       signal: AbortSignal.timeout(timeoutMs),
     });
@@ -1709,7 +1710,7 @@ async function postJsonStrict<T = unknown>(
 ): Promise<T | null> {
   const res = await fetch(url, {
     method: "POST",
-    headers: { "Content-Type": "application/json" },
+    headers: agentmemoryJsonHeaders(),
     body: JSON.stringify(body),
     signal: AbortSignal.timeout(timeoutMs),
   });
@@ -1751,7 +1752,7 @@ async function seedDemoSession(
     try {
       const res = await fetch(url, {
         method: "POST",
-        headers: { "Content-Type": "application/json" },
+        headers: agentmemoryJsonHeaders(),
         body: JSON.stringify(payload),
         signal: AbortSignal.timeout(5000),
       });
diff --git a/src/cli/http-auth.ts b/src/cli/http-auth.ts
new file mode 100644
index 00000000..41bac3d8
--- /dev/null
+++ b/src/cli/http-auth.ts
@@ -0,0 +1,15 @@
+export function agentmemoryAuthHeaders(
+  env: NodeJS.ProcessEnv = process.env,
+): Record<string, string> {
+  const secret = env["AGENTMEMORY_SECRET"]?.trim();
+  return secret ? { Authorization: `Bearer ${secret}` } : {};
+}
+
+export function agentmemoryJsonHeaders(
+  env: NodeJS.ProcessEnv = process.env,
+): Record<string, string> {
+  return {
+    "Content-Type": "application/json",
+    ...agentmemoryAuthHeaders(env),
+  };
+}
diff --git a/test/cli-http-auth.test.ts b/test/cli-http-auth.test.ts
new file mode 100644
index 00000000..3f0ab840
--- /dev/null
+++ b/test/cli-http-auth.test.ts
@@ -0,0 +1,26 @@
+import { describe, expect, it } from "vitest";
+import {
+  agentmemoryAuthHeaders,
+  agentmemoryJsonHeaders,
+} from "../src/cli/http-auth.js";
+
+describe("CLI HTTP auth headers", () => {
+  it("omits Authorization when AGENTMEMORY_SECRET is unset", () => {
+    expect(agentmemoryAuthHeaders({})).toEqual({});
+    expect(agentmemoryJsonHeaders({})).toEqual({
+      "Content-Type": "application/json",
+    });
+  });
+
+  it("adds Bearer auth when AGENTMEMORY_SECRET is configured", () => {
+    const env = { AGENTMEMORY_SECRET: "secret-token" };
+
+    expect(agentmemoryAuthHeaders(env)).toEqual({
+      Authorization: "Bearer secret-token",
+    });
+    expect(agentmemoryJsonHeaders(env)).toEqual({
+      "Content-Type": "application/json",
+      Authorization: "Bearer secret-token",
+    });
+  });
+});